Mattermost は CSRF トークンを適切に検証しません

Successful exploitation of CVE-2026-27659 could allow an attacker to gain unauthorized control over Mattermost's access control policies. This could lead to scenarios where sensitive data is exposed, unauthorized users are granted access, or critical system functions are compromised. For example, an attacker could disable access controls for specific channels or teams, effectively granting themselves or others unrestricted access. The blast radius extends to any data or functionality protected by the manipulated access control policies. The ability to modify access control policies represents a significant escalation of privilege within the Mattermost environment.

Organizations heavily reliant on Mattermost for internal communication and collaboration are particularly at risk. Teams with lax access control policies or those that frequently grant administrative privileges to non-technical users are also more vulnerable. Shared hosting environments where multiple Mattermost instances share the same server could also be affected, potentially allowing an attacker to exploit the vulnerability across multiple instances.

• linux / server: Monitor Mattermost access logs for unusual activity related to the /api/v4/accesscontrolpolicies/{policy_id}/activate endpoint. Look for requests originating from unexpected IP addresses or user agents.

journalctl -u mattermost -f | grep '/api/v4/access_control_policies/'

• generic web: Use curl to test the endpoint with a crafted CSRF token. Verify that the server rejects the request if the token is invalid.

curl -X POST -H "Content-Type: application/json" -H "X-CSRF-Token: INVALID_TOKEN" "https://mattermost.example.com/api/v4/access_control_policies/{policy_id}/activate"

• go: Examine Mattermost server code for instances of the vulnerable endpoint and ensure CSRF token validation is properly implemented. Review recent code changes for potential regressions.

1. 2026-03-25Disclosure

   disclosure

2. 2026-03-25Patch

   patch

1. 予約済み2026-02-23
2. 公開日2026-03-25
3. 更新日2026-03-31
4. EPSS 更新日2026-04-02

The primary mitigation for CVE-2026-27659 is to upgrade Mattermost to version 11.4.1 or later. If immediate upgrading is not possible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the nature of CSRF, enforcing strict authentication and authorization policies can reduce the attack surface. Review and audit existing access control policies to identify any anomalies or suspicious configurations. Educate administrators about the risks of CSRF and the importance of verifying requests before executing them. After upgrading, confirm the fix by attempting to trigger the vulnerable endpoint with a crafted CSRF request and verifying that it is rejected.